What the CRA asks of importers and distributors

Most writing about the Cyber Resilience Act is written for the company that builds the product. If you bring someone else's product into the Union, or make it available on the market, almost none of it describes your position — and the parts that do are buried in two articles that nobody quotes.

This guide is those two articles, in the order you would actually need them.

First: the obligations that are not yours

The ones that get the headlines belong to the manufacturer:

• the Article 14 reporting clock — early warning within 24 hours of becoming aware that a vulnerability in the product is being actively exploited, notification within 72 hours, final report within 14 days;
• the essential requirements of Annex I, including a machine-readable SBOM and a coordinated vulnerability disclosure policy;
• the technical documentation of Annex VII, kept current across releases;
• the conformity assessment and the CE marking.

You do not do any of that for a product you did not make. Being told otherwise is the most common way an importer wastes a quarter.

One thing flips it. Under Article 21, an importer or distributor is considered to be a manufacturer — and becomes subject to Articles 13 and 14 in full — where it "places a product with digital elements on the market under its name or trademark or carries out a substantial modification of a product with digital elements already placed on the market". White-labelling is not a commercial detail; it is the line between this guide and the other one. If it describes you, run the scope check again and say so, and you will get the manufacturer's answer instead.

If you import: Article 19

An importer places on the Union market products from a manufacturer established outside the Union. Article 19 gives you a verification duty, a stop duty, a record duty and an information duty.

Verify before placing on the market. Article 19 requires the importer to check that the manufacturer carried out the conformity assessment, that the technical documentation exists, that the product bears its marking, and that the manufacturer met the identification and instruction requirements that fall on it. In practice this is a supplier conversation and a file — and the file is the part that survives.

Do not place a non-conforming product. Where an importer "considers or has reason to believe" that the product, or the processes the manufacturer put in place, are not in conformity with the Regulation, the importer must not place it on the market. "Reason to believe" is a lower bar than knowledge, and it is assessed afterwards, against what you were told and what you asked.

Keep the records. Article 19 requires the importer to keep the relevant documentation for at least ten years after the product is placed on the market, or for the support period, whichever is longer.

Inform — and this is your clock. Article 19(5): on becoming aware of a vulnerability in the product, the importer must inform the manufacturer without undue delay. And where the product presents a significant cybersecurity risk, the importer must immediately inform the market surveillance authorities of the Member States in which it made the product available, giving details of the non-compliance and of any corrective measures taken.

That last sentence is the one worth putting on a wall. It is not the manufacturer's 24 hours, but it is not "when convenient" either, and it names an authority.

If you distribute: Article 20

A distributor makes a product available on the market without being the manufacturer or the importer. Article 20 asks for due care, a check, and the same information duty.

Check before making available. Article 20(2) requires the distributor to verify that the product bears the CE marking and that the manufacturer and importer complied with their identification, instruction and contact obligations and provided the necessary documents.

Act with due care. The distributor must act with due care in relation to the requirements of the Regulation, and must not make a product available where it has reason to believe it does not conform. Due care is a documented process: what you check before listing a product, who checked it, and what they kept.

Inform. Article 20(4) mirrors Article 19(5): on becoming aware of a vulnerability, inform the manufacturer without undue delay; where the product presents a significant cybersecurity risk, inform the market surveillance authorities of the Member States where you made it available, immediately, with the details of the non-compliance and of any corrective measures.

What to have in place

Neither article asks you to build a product security programme. Both assume you can answer four questions on a bad day:

1. Where does a vulnerability report land? A public address that reaches a person, not a shared inbox nobody owns.
2. Who reaches the manufacturer, and how fast? Named contact, agreed channel, in the supply contract rather than in someone's email history.
3. Who decides that a risk is "significant"? Decide the escalation rule while it is cheap, because you will be applying it under time pressure.
4. Could you produce your verification file tomorrow? Conformity assessment evidence, technical documentation reference, marking, contacts — per supplier, per product.

Dates

The Article 14 reporting obligations are in force since 11 September 2026, and under Article 69(3) they reach every in-scope product placed on the market before 11 December 2027. They are the manufacturer's obligations — but a manufacturer that cannot hear from you cannot meet them, which is why your information duty and their reporting duty are the same mechanism seen from two sides.

The rest of the Regulation applies from 11 December 2027. Under Article 69(2), a product already on the market before that date becomes subject to the requirements only if it undergoes a substantial modification from that date onwards.

→ Check which role the Regulation puts you in — two minutes, with the article behind each answer.